Chapter 10: Advanced PIX Configurations

Introduction

Now that you have learned how to pass simple traffic through the PIX firewall, we are ready to dive in and deal with configurations that are more complex. In this chapter, we discuss some of the more advanced features that the PIX firewall has to offer. You will learn how the PIX can be configured to handle complex protocols that operate over multiple or dynamic ports. In some cases, these protocols embed IP addresses and port information inside the payload of data packets, creating a challenge for performing NAT/PAT. The PIX firewall also has the ability to block Web traffic, including Java and ActiveX applications. The PIX firewall provides integrated intrusion detection features for common information-gathering stacks and network attacks. We will look at how to use the integrated IDS signature in the PIX firewall to detect patterns of network misuse. In small office/home office (SOHO) environments, it might be beneficial to use the DHCP client and server functionality provided by the PIX firewall. In this chapter, we examine both of these features in detail and show how to use them. Finally, we complete this chapter by discussing unicast and multicast routing, Point to Point Protocol over Ethernet (PPPoE), and reverse-path forwarding.